#

"Seth I. Rich" (sir@po.cwru.edu)
Wed, 17 Jan 1996 09:41:31 PST

- Messages sorted by:[ date ][ thread ][ subject ][ author ]

    >> How about comparing
    >>   call_function("notify", player, foo);
    >> with
    >>   eval("notify(player, " + FOO + ");");
    >> ...?  The latter leaves you wide-open for people to slip in nasties,
    >>while using call_function() makes you safer.

    >I'm sorry, I don't follow you.. how could the later pose a threat?

    I see I screwed up my example above, so I'll fix it here.

    What if foo == "hi\");recycle(player" ?  Then you'd

       eval("notify(player, \"" + FOO + ");");
    => eval("notify(player, \"" + "hi\");recycle(player" + ");");
    => eval("notify(player, \"hi\");recycle(player);");
    => notify(player, "hi");
       recycle(player);

    ... which could have very nasty side effects.

    Seth / Blackbriar
    ---------------------------------------------------------------------------
    Seth I. Rich - sir@po.cwru.edu                         no, no quote.
    Rabbits on walls, no problem.                          it's far too cold.